Intelligent Alerts

The new Intelligent Alerts system allows for more granular control over alerts and integrates anomaly detection with the alert system.

Overview

The new Alert Builder and Alert Manager in Analysis Workspace replace the existing alert functionality in Reports & Analytics. Intelligent Alerts let you

  • Build alerts based on anomalies (90%, 95%, 99%, 99.75%, and 99.9% thresholds; % change; above/below).
  • Preview how often an alert will trigger.
  • Send alerts by e-mail or SMS with links to auto-generated Analysis Workspace projects.
  • Create "stacked" alerts that capture multiple metrics in a single alert.

Components of the new alert system include: Alert Builder, Alert Manager, Alert Preview, and better in-context access to creating alerts. The old alert system user interface will no longer be available, but the alerts will be migrated. Some legacy alert features will no longer be available.

There are four ways get to the Alert Builder:

  • By using the following shortcut in Analysis Workspace:

    ctrl (or cmd) + shift + a

  • By going directly to the Alert Builder: Workspace > Components > New Alert.
  • By selecting one or more freeform table line item/s, right-clicking and selecting Create Alert from Selection. This will open the Alert Builder and will pre-populate the builder with the appropriate metrics and filters applied from the table. You can then edit the alert, if needed.



  • From within a Reports & Analytics report, by going to More > Add Alert. This will open the new Alert Builder and will pre-populate the builder with the appropriate metrics and filters applied from the report. You can then edit the alert, if needed.



FAQ: how alerts are calculated and triggered

The % thresholds are standard deviations. For example, 95% = 2 standard deviations and 99% = 3 standard deviations. Depending on the time granularity you choose, different models are used to calculate how far away (how many standard deviations) each data point is from the norm. If you set a lower threshold (such as 90%), you will get more anomalies than if you set a higher threshold (99%). 99.75% & 99.99% thresholds were introduced specifically for the hourly granularity so that it wouldn’t trigger as many anomalies.

Question Answer

Q: How far back does the alert's anomaly detection go to determine data anomalies?

The training period varies based on the granularity selected. (See Statistical Techniques used in Anomaly Detection for more detail.) Here is a summary:

  • Monthly = 15 months + same range last year
  • Weekly = 15 weeks + same range last year
  • Daily = 35 days + same range last year
  • Hourly = 336 hours

Q: If I want to be alerted to only a dip in behavior or only a spike in behavior, can I use the anomaly feature or do I need to use absolute value?

Using absolute value would still trigger alerts on dips as well as spikes. You cannot isolate alerts for just dips or just spikes.

Q: Can I configure alerts to trigger only during certain hours of the day (such as business hours vs. non-business hours)?

Currently, no.

Q: Can I get a table of the “expected values” that comprise the dotted line, or some sort of output of what those values are?

Not in Workspace, but you can in Report Builder (see this video on Anomaly Detection in Report Builder).

Keep in mind that Report Builder uses less sophisticated anomaly detection methods. It uses a fixed 30-day training period, fixed 95% interval, and is similar to Reports & Analytics anomaly detection.